Topo-ADV: Generating Topology-Driven Imperceptible Adversarial Point Clouds

Gayathry Chandramana Krishnan Nampoothiry; Raghuram Venkatapuram; Anirban Ghosh; Ayan Dutta

cs.CVApr 10, 2026

Topo-ADV: Generating Topology-Driven Imperceptible Adversarial Point Clouds

Authors: Gayathry Chandramana Krishnan Nampoothiry, Raghuram Venkatapuram, Anirban Ghosh, Ayan Dutta

Organizations: University of North Florida, Jacksonville, USA

Abstract

Deep neural networks for 3D point cloud understanding have achieved remarkable success in object classification and recognition, yet recent work shows that these models remain highly vulnerable to adversarial perturbations. Existing 3D attacks predominantly manipulate geometric properties such as point locations, curvature, or surface structure, implicitly assuming that preserving global shape fidelity preserves semantic content. In this work, we challenge this assumption and introduce the first topology-driven adversarial attack for point cloud deep learning. Our key insight is that the homological structure of a 3D object constitutes a previously unexplored vulnerability surface. We propose Topo-ADV, an end-to-end differentiable framework that incorporates persistent homology as an explicit optimization objective, enabling gradient-based manipulation of topological features during adversarial example generation. By embedding persistence diagrams through differentiable topological representations, our method jointly optimizes (i) a topology divergence loss that alters persistence, (ii) a misclassification objective, and (iii) geometric imperceptibility constraints that preserve visual plausibility. Experiments demonstrate that subtle topology-driven perturbations consistently achieve up to 100% attack success rates on benchmark datasets such as ModelNet40, ShapeNet Part, and ScanObjectNN using PointNet and DGCNN classifiers, while remaining geometrically indistinguishable from the original point clouds, beating state-of-the-art methods on various perceptibility metrics.

Figures & tables

Panel of Figure 1 — Figure 1: An airplane point cloud from ModelNet40 and its adversarial counterpart generated by Topo-ADV are shown alongside their corresponding persistence diagrams. The adversarial point cloud causes PointNet to misclassify the airplane as a piano . Note that the persistence diagram changed after we perturbed the original point cloud.

Model	Method	ASR(%) $\uparrow$	CSD $\downarrow$	Uniform $\downarrow$
PointNet	IFGSM( $l_{\infty}$ )	99.01	2.6341	0.3134
	IFGM( $l_{2}$ ) [ 23 ]	99.68	1.6502	0.3173
	3D-ADV [ 38 ]	100.00	0.9500	0.2965
	KNN [ 33 ]	99.68	2.3133	0.3695
	GeoA 3 [ 36 ]	100.00	1.7112	0.2919
	SI-ADV [ 20 ]	99.32	1.4601	0.3059

Table 1: Comparison of adversarial attacks on ModelNet40 . Best results per column are highlighted in bold.

Model	Method	ASR(%) $\uparrow$	CSD $\downarrow$	Uniform $\downarrow$
PointNet	IFGSM( $l_{\infty}$ )	95.20	2.8831	0.3035
	IFGM( $l_{2}$ ) [ 23 ]	97.49	2.3401	0.2404
	3D-ADV [ 38 ]	100.00	2.1603	0.2103
	KNN [ 33 ]	96.40	2.5067	0.2723
	GeoA 3 [ 36 ]	100.00	3.7291	0.2658
	SI-ADV [ 20 ]	96.38	2.8476	0.2945

Table 2: Comparison of adversarial attacks on ShapeNet Part . Best results per column are highlighted in bold.

Panel of Figure 2 — Figure 2: Visualization of representative original and adversarial ShapeNet Part point clouds generated by Topo-ADV, together with their misclassified labels. The top row represents the clean point clouds, the middle and bottom rows present the adversarial point clouds generated with PointNet and DGCNN as victim models, respectively.

Method	Chamfer distance $\downarrow$	Hausdorff distance $\downarrow$	$\mathcal{L}_{2}$ distance $\downarrow$
CFG [ 25 ]	0.32	0.36	0.22
Topo-ADV (ours)	0.0024	0.23	0.54

Table 3: Comparison of imperceptibility on ModelNet40 dataset with [ 25 ] .

Metric \ Config	Default	$R=0$	$R=0$ , $T=100$	w/ $\mathcal{L}_{\text{cls}}$ , $\mathcal{L}_{\text{PH}}$	w/ $\mathcal{L}_{\text{cls}}$
ASR (%) $\uparrow$	99.86	99.47	99.04	99.09	99.19

Table 4: Ablation results with PointNet and ModelNet40.

$\epsilon$	ASR (%) $\uparrow$	CSD $\downarrow$	Uniform $\downarrow$
0.55 (default)	99.86	1.2328	0.0121
0.75	99.90	1.2300	0.0121
1.0	99.95	1.2322	0.0121

Table 5: Analyzing the effect of

\epsilon

with PointNet and ModelNet40.

Method	ASR (%)
3D-Adv [ 38 ]	9.2
KNN [ 33 ]	7.2
GeoA 3 [ 36 ]	4.4
AdvPC [ 15 ]	19.6
Topo-ADV (Ours)	21.2
PF-Attack [ 16 ]	21.3

Table 6: Transferability results with

\epsilon=0.18

and ModelNet40, where the adversarial point clouds were generated using DGCNN and the victim model was PointNet. The numbers for the baselines in this table are from [ 16 ] , and we used the same

\epsilon

for this comparison.

Method	ASR (%)
3D-Adv [ 38 ]	6.8
KNN [ 33 ]	6.0
GeoA 3 [ 36 ]	7.2
AdvPC [ 15 ]	22.4
Topo-ADV (Ours)	22.9
PF-Attack [ 16 ]	24.8

Table 7: Transferability results with

\epsilon=0.18

and ModelNet40, where the adversarial point clouds were generated using PointNet and the victim model was DGCNN. The numbers for the baselines in this table are from [ 16 ] , and we used the same

\epsilon

for this comparison.

Panel of Figure 3 — Figure 3: Visualization of representative original and adversarial ScanObjectNN point clouds generated by Topo-ADV, together with their misclassified labels. The top row represents the clean point clouds, the middle and bottom rows present the adversarial point clouds generated with PointNet and DGCNN as victim models, respectively.

Panel of Figure 4 — Figure 4: Visualization of representative original and adversarial ModelNet40 point clouds generated by Topo-ADV, together with their misclassified labels, for varied values of the budget $\epsilon$ . The victim model is PointNet.

Explore similar work

Beyond Defenses: Manifold-Aligned Regularization for Intrinsic 3D Point Cloud Robustness
May 8, 2026Pedro Alonso, Chongshou Li, Tianrui LiPoint Cloud Classification Adversarial Robustness
School of Computing and Artificial Intelligence, Southwest Jiaotong University, Chengdu, 611756, China · Engineering Research Center of Sustainable Urban Intelligent Transportation, Ministry of Education, Southwest Jiaotong University, Chengdu, 611756, China
APC: Transferable and Efficient Adversarial Point Counterattack for Robust 3D Point Cloud Recognition
Apr 17, 2026Geunyoung Jung, Soohong Kim, Inseok Kong +1Point Cloud Classification Adversarial Robustness
Department of Artificial Intelligence, University of Seoul, South Korea · Department of Geo Informatics, University of Seoul, South Korea
A Persistent Homology Design Space for 3D Point Cloud Deep Learning
Apr 5, 2026Prachi Kudeshia, Jiju Poovvancheri, Amr Ghoneim +1Persistent Homology Topological Representation Learning
Saint Mary’s University, Halifax, Canada · Nanjing Forestry University, China

May 8, 2026J/K move · Enter open · S save

Beyond Defenses: Manifold-Aligned Regularization for Intrinsic 3D Point Cloud Robustness

Pedro Alonso, Chongshou Li, Tianrui Li

School of Computing and Artificial Intelligence, Southwest Jiaotong University, Chengdu, 611756, China · Engineering Research Center of Sustainable Urban Intelligent Transportation, Ministry of Education, Southwest Jiaotong University, Chengdu, 611756, China

Point Cloud Classification Adversarial Robustness

Open paper AskPDF arXiv

Despite extensive progress in point cloud robustness, existing methods primarily rely on augmentation strategies or defense mechanisms while overlooking the geometric nature of adversarial fragility. We hypothesize that adversarial vulnerability in 3D networks arises from a manifold misalignment between the latent geometry learned by the model and the intrinsic geometry of the underlying surface. Small, geometry-preserving perturbations along the input manifold often induce disproportionate distortions in feature space, potentially leading to misclassifications. We formalize this phenomenon by developing a geometric interpretation of 3D robustness that links classical adversarial theory to the intrinsic structure of point clouds. Motivated by this analysis, we introduce Manifold-Aligned Point Recognition (MAPR), a framework that regularizes the latent geometry by aligning predictions across intrinsic perturbations. MAPR augments each point cloud with intrinsic features capturing local curvature and diffusion structure, and applies a consistency loss that preserves invariance to intrinsic, geometry-preserving perturbations. Without relying on adversarial training or additional data, MAPR consistently improves robustness under multiple adversarial attacks across several datasets, achieving average robustness gains of +20.02 and +8.83 percentage points over vanilla models on ModelNet40 and ScanObjectNN, respectively.

Abstract

Explore similar work

Beyond Defenses: Manifold-Aligned Regularization for Intrinsic 3D Point Cloud Robustness

APC: Transferable and Efficient Adversarial Point Counterattack for Robust 3D Point Cloud Recognition

A Persistent Homology Design Space for 3D Point Cloud Deep Learning